1

Basically, I am trying to sniff the network traffic from my other computer. So here's the situation:

I am in a network, where:

192.168.1.1 - default gateway
192.168.1.24 - "victim" (my other computer)
192.168.1.20 - "attacker"

I am using bettercap, but I actually tried ettercap before. Steps to reproduce:

echo 1 > /proc/sys/net/ipv4/ip_forward
bettercap -i wlan0
> arp.spoof targets 192.168.1.24
> arp.spoof on

Then I can check that it works by actually pinging 192.168.1.20, the attacker IP, and it responds rapidly quick, so I actually ping the default gateway. I guess that's how it works, right?

Then I run some sniffing. Tried multiple tools:

urlsnarf - doesn't show anything. It can actually show the localhost traffic (done from the attacker pc)
dsniff - same as above
tshark/wireshark - They are showing some udp/tcp packets, but still no http ones (f.e entering a website, POSTing in a fake user/pass form)
bettercaps net.sniff - actually pretty much the same as tshark/wireshark

I uncommented those 2 iptables lines from ettercap.conf, when I was using ettercap (btw, I was doing: ettercap -Tqi wlan0 -M arp (or arp:remote) // //

So my question here is: Is there something wrong with my spoofing, or do I need to sniff somehow different?

P.S I tried those things on both Kali and Blackarch. P.S 2 I actually tried bettercaps dns.spoof and it also works only on the "attacker" pc, when I ping or go to some website on my "victim" machine, everything works fine - so not fine, cuz it should redirect

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.